CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References

What is CVE-2024-2441?

CVE-2024-2441 is a high-severity missing authorization vulnerability in Unknown VikBooking Hotel Booking Engine & PMS, published on 10 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

Weakness: CWE-285

Which versions are affected by CVE-2024-2441?

It affects 1 product.

Products include Vikwp Vikbooking Hotel Booking Engine \& Pms.

How do I fix CVE-2024-2441?

No fix has been published for CVE-2024-2441 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-2441 being exploited?

There is no known exploitation of CVE-2024-2441 in the wild and no public exploit code.

Other vulnerabilities in Unknown VikBooking Hotel Booking Engine & PMS

• CVE-2024-11641 Cross-site request forgery in VikBooking Hotel Booking Engine & PMS High 8.8
• CVE-2023-25707 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) Medium 6.3
• CVE-2024-2749 VikBooking < 1.6.8 - Broken Access Control Medium 5.9
• CVE-2023-24396 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS) Medium 5.9
• CVE-2024-13616 VikBooking < 1.7.2 - Admin+ Stored XSS Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r566-fcmc-4j3v.